Lockdown intranet services behind tailscale

2024-06-21 20:02:56 -06:00
parent 4d658e10d3
commit d557820d6c
10 changed files with 162 additions and 160 deletions
--- a/common/server/nginx.nix
+++ b/common/server/nginx.nix
@@ -4,6 +4,10 @@ let
  cfg = config.services.nginx;
 in
 {
+  options.services.nginx = {
+    openFirewall = lib.mkEnableOption "Open firewall ports 80 and 443";
+  };
+
  config = lib.mkIf cfg.enable {
    services.nginx = {
      recommendedGzipSettings = true;
@@ -12,6 +16,8 @@ in
      recommendedTlsSettings = true;
    };

-    networking.firewall.allowedTCPPorts = [ 80 443 ];
+    services.nginx.openFirewall = lib.mkDefault true;
+
+    networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [ 80 443 ];
  };
 }